Brinks Home Hit via Microsoft Entra Vishing

How the Attack Reportedly Worked

Brinks Home has said it is investigating a cybersecurity incident after the group ShinyHunters claimed responsibility, stating the intrusion began with a Microsoft Entra vishing campaign. Rather than exploiting a software flaw, the described method relied on phone calls to employees, persuading them to approve authentication requests, register attacker-controlled devices, or complete identity verification steps. If successful, these actions would grant attackers legitimate-looking access to corporate accounts, bypassing many technical controls entirely.

Brinks Home confirmed that the attacker threatened to publicly release data but has not confirmed what, if anything, was actually accessed. ShinyHunters has alleged theft of Salesforce customer records, employee PII, and large volumes of customer support chat logs, but these claims have not been independently verified.

Why This Type of Attack Succeeds

Vishing campaigns targeting identity systems succeed because they exploit the human element rather than a technical vulnerability. Employees are conditioned to be helpful and responsive to IT-sounding requests, especially when a caller frames the situation as urgent, such as stopping suspicious activity or restoring account access. When an employee approves an authentication prompt or allows a new device to be registered, the resulting access looks legitimate to monitoring systems, making detection harder after the fact.

What to Watch For

Defenders and employees should be alert to several warning signs:

• An unsolicited phone call asking you to approve an authentication or MFA prompt you did not initiate
• Pressure or urgency to act immediately on an identity-related request
• Requests to enroll a new device or change authentication settings during a call
• Callers claiming to be internal IT or Microsoft Entra support without a way to verify their identity

These tactics target all employees, but help desk staff, IAM teams, and customer support are especially attractive targets because of the access and trust associated with their roles.

Building Resistance

Organizations can reduce exposure to this style of attack by:

• Treating unexpected calls about account security as suspicious and verifying requests through a known internal IT channel before approving any login prompt
• Training employees to never approve authentication prompts they did not start, and to report them immediately
• Strengthening help desk identity verification procedures and restricting who can enroll new devices or MFA methods
• Monitoring Microsoft Entra, Salesforce, and other cloud platforms for unusual authentication activity

Because this technique targets identity rather than infrastructure, technical controls alone are not enough. Combining phishing-resistant MFA, tighter help desk verification, and ongoing monitoring gives organizations a better chance of catching these attempts before access is granted.

What happened in the Brinks Home incident?

Brinks Home said it is investigating a cybersecurity incident after ShinyHunters claimed to have breached the company using a Microsoft Entra vishing campaign targeting employees.

How did the attackers reportedly gain access?

According to the claims, attackers called employees and persuaded them to approve authentication requests, register attacker-controlled devices, or complete identity verification steps that granted access to corporate accounts.

What data was allegedly stolen?

ShinyHunters alleges theft of Salesforce customer records, employee PII, and customer support chat logs, though Brinks Home has not confirmed what data was accessed and these claims are not independently verified.

How can organizations defend against this type of attack?

Recommended defenses include strengthening help desk identity verification, restricting unauthorized device registration and MFA enrollment, and monitoring Microsoft Entra and Salesforce for unusual authentication activity.